Light

Episode #947 Quiz

Article 45
Date: 2023-11-07 | Length: 2 hrs | Episode page at twit.tv

About this episode

Microsoft is moving Azure signing keys into hardened HSMs and confidential computing, with encrypted-at-rest/in-transit/process and automated rotation. Trend Micro disclosed four Exchange zero-days, including unauthenticated deserialization RCE and URI-based information disclosure, but Microsoft deferred fixes. ActiveMQ and Citrix Bleed showed exploitation, credential theft, persistence, and mass compromise patterns.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did Microsoft say it was moving into its integrated hardened Azure HSM and confidential computing infrastructure as part of the Secure Future Initiative?

Question 1

According to the episode, what did Microsoft say it was moving into its integrated hardened Azure HSM and confidential computing infrastructure as part of the Secure Future Initiative?

Azure storage keys TLS session keys Identity signing keys Customer encryption keys

Question 2: Why did Trend Micro's Zero-Day Initiative publish rough descriptions and locations for four Exchange Server zero-days after Microsoft declined to fix them immediately?

Question 2

Why did Trend Micro's Zero-Day Initiative publish rough descriptions and locations for four Exchange Server zero-days after Microsoft declined to fix them immediately?

To satisfy a public disclosure deadline from the Apache project To disclose the flaws only after Microsoft issued patches To warn Exchange admins about the security risks To provide a working exploit to defenders

Question 3: What was the key reason Mandiant said it was difficult to investigate the Citrix NetScaler exploitation?

Question 3

What was the key reason Mandiant said it was difficult to investigate the Citrix NetScaler exploitation?

The appliance encrypted all endpoint logs with customer keys The appliance did not log requests or errors to the vulnerable endpoint The exploit required no authentication and disabled all network telemetry The attack only affected outbound traffic and left no server-side artifacts

Question 4: What sequence of tools did Mandiant say attackers used to stage and exfiltrate reconnaissance results after Citrix session hijacking?

Question 4

What sequence of tools did Mandiant say attackers used to stage and exfiltrate reconnaissance results after Citrix session hijacking?

7-zip to segment archives, then certutil to Base64-encode them net.exe to compress archives, then certutil to sign them Mimikatz to segment archives, then 7-zip to decode them SoftPerfect netscan to encrypt archives, then Slack to transmit them

Question 5: What specific ability did the proposed Article 45 give to EU member states and recognized third-party countries regarding browser trust?

Question 5

What specific ability did the proposed Article 45 give to EU member states and recognized third-party countries regarding browser trust?

To mandate TLS 1.3-only connections for all websites To require browsers to display additional security banners To limit root certificates to domestic certificate authorities only To designate cryptographic keys for which trust is mandatory

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.